Vulnerability · Published Jun 27, 2024 · Assigned by @huntr_ai
CVE-2024-5826Remote Code Execution via Prompt Injection in vanna-ai/vanna
Critical 9.8
In plain English
A critical-severity code injection in vanna-ai/vanna from vanna-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Official description
In the latest version of vanna-ai/vanna, the `vanna.ask` function is vulnerable to remote code execution due to prompt injection. The root cause is the lack of a sandbox when executing LLM-generated code, allowing an attacker to manipulate the code executed by the `exec` function in `src/vanna/base/base.py`. This vulnerability can be exploited by an attacker to achieve remote code execution on the app backend server, potentially gaining full control of the server.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | vanna | no fix listed | GHSA-rrqq-fv6m-692m |
| PyPI | vanna | no fix listed | PYSEC-2026-562 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| vanna-ai | vanna-ai/vanna | unspecified – through latest |
Weakness: CWE-94 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H